feat(player): add avatar-centered drag steering

PLANS.md

@@ -1561,7 +1561,7 @@ controlled measurement criteria:
 
 ## Milestone 017 — Avatar-centered drag steering and latency remediation
 
-**Status:** `NOT_STARTED`
+**Status:** `IN_PROGRESS`
 
 ### Objective
 
@@ -1652,9 +1652,35 @@ immediate and never approaches the observed 500 ms delay.
 
 ### Evidence
 
-Not started. This milestone records the project owner's 2026-09-09 decisions:
-the child drags the centered player icon; the icon deflects slightly as the
-control handle while the authoritative map moves below it; displacement controls
-speed; approximately 100 ms is ideal, 150 ms is acceptable, and delays near
-500 ms are unacceptable. Implementation must wait for Milestone 016 to identify
-and prioritize the actual latency contributors.
+Implementation and automated validation are in progress. This milestone records
+the project owner's 2026-09-09 decisions: the child drags the centered player
+icon; the icon deflects slightly as the control handle while the authoritative
+map moves below it; displacement controls speed; approximately 100 ms is ideal,
+150 ms is acceptable, and delays near 500 ms are unacceptable.
+
+- On 2026-09-09, the browser control was changed from a separate joystick to a
+  96 by 96 CSS-pixel transparent target around the centered avatar. The visible
+  avatar deflects at most 28 CSS pixels, uses a 12-pixel dead zone and diagonal
+  hysteresis, and schedules cardinal repeats from 360 ms to 170 ms. It resets
+  on release, cancellation, lost pointer capture, pause, disconnect, blur, and
+  hidden-document events. `LatestIntentFlow` keeps one sent move in flight and
+  retains at most one replacement intention; release discards the replacement.
+  The map continues to render only complete server-authoritative projections.
+- On 2026-09-09, `node --test test/web/test_player_app.js` passed all 17 tests,
+  including avatar bounds, cadence, direction hysteresis, latest-intent
+  coalescing, reset paths, authoritative projections, keyboard/swipe
+  alternatives, observer immutability, and bounded diagnostics. `bash
+  scripts/run_host_tests.sh` passed all host tests and deterministic web-asset
+  verification (`2ca96e65b3aa06385028c420c7e605b2e422f7d0c57cae2d81e277a53ecdf6b3`,
+  25,121 of 1,572,864 allowed compressed bytes).
+- On 2026-09-09, `/home/sasa/.platformio/penv/bin/pio run -e
+  esp32-c6-devkitm-1` passed with 58,868 of 327,680 RAM bytes and 1,027,966 of
+  2,097,152 application bytes. `/home/sasa/.platformio/penv/bin/pio run -e
+  esp32-c6-devkitm-1 --target buildfs` passed and reported a fixed LittleFS
+  image of 2,031,616 of 2,031,616 bytes.
+- `docs/M017_LATENCY_REPORT.md` records the M016 baseline, the browser backlog
+  remediation, the required isolated-LAN deployment setup, and the controlled
+  before-and-after retest procedure. The physical mobile usability observation,
+  isolated-network 200-sample runs, and maximum-session diagnostics are still
+  required for acceptance criteria 6, 7, 9, and 10. Milestone 017 remains
+  `IN_PROGRESS`; Milestone 018 has not been started.